Security News Fake Flash Player installs AtlasRAT

[Brownie2019]

Content source

https://www.malwarebytes.com/blog/news/2026/07/fake-flash-player-installs-atlasrat

Researchers have described a campaign that delivers a remote access Trojan (RAT) called AtlasRAT through a fake Flash Player installer.

People still go looking for “Flash player” because a surprising amount of content and software was built around Flash and never properly migrated. Users often just want a quick way to get those old sites, games, or business apps working again.

The underlying problem is that Adobe ended support for Flash Player on December 31, 2020, and actively blocks Flash content from running in the official player.

Attackers know some people will still search for Flash to run a game or a business app, so they wrap their malware in a fake Flash‑related installer that looks familiar and legitimate.

That’s likely why the AtlasRAT infection chain starts with a Delphi executable named FlashPlay.Exe, masquerading as an “AGE Flash Player” installer. The first-stage loader runs entirely in memory and reconstructs additional payloads instead of dropping obvious files to disk, a technique often referred to as fileless malware.

The final payload (MainDll.Dll) uses a self‑signed certificate spoofing CN=update.Microsoft.Com to initialize Transport Layer Security (TLS) client communication and encrypts Command and Control (C2) traffic.

A self‑signed certificate means the owner signs with their own key instead of a trusted certificate authority (CA). That means an attacker can create a certificate claiming to be update.microsoft.com or google.com, even though they don’t control those domains. A web browser would reject such a certificate with a warning. Custom malware, however, can simply ignore the operating system’s trust checks and use it to set up encrypted C2.

Once AtlasRAT is installed, the operator gains long‑term remote control of the infected Windows system with capabilities including:

• Collecting credentials via offline keylogging
• Gathering system information and identifying installed security products
• Exfiltrating data over encrypted channels
• Injecting DLLs into applications like WeChat, potentially allowing the attacker to monitor or manipulate messaging, or to hide malware activity or connectivity.

Based on historical data, the researchers suspect that AtlasRAT is a reusable framework or commercial offering rather than a one-off tool used by a single group.

How to stay safe​

When looking for apps and software to perform a specific task, remember that cybercriminals often exploit popular searches in semi-targeted attacks. In previous campaigns, for example, AtlasRAT has also been distributed as a fake VPN installer.

Some tips to keep this RAT, and others, off your computer:

• Carefully check what you’re about to install. Sponsored search results are not a guarantee that software is legitimate.
• Use an up-to-date, real-time anti-malware solution to detect and block remote access Trojans. Malwarebytes detected AtlasRAT as Malware.AI.1710771908
• Keep your operating system, browser, and security software up to date.

 

[Bot]

Key takeaway

Adobe Flash Player should not be installed today. It reached end of life on December 31, 2020, and legitimate Flash Player downloads are no longer available or supported. A modern browser or operating system should not require a “Flash Player” installer.

The use of a self-signed certificate with a Microsoft-looking common name is not evidence of Microsoft ownership or trust. Malware can create such certificates, so the certificate’s subject name alone should not be treated as a security indicator.

If the installer was executed

• Disconnect the affected computer from the network, especially if suspicious activity is visible.
• Do not enter passwords or use sensitive accounts from that system.
• Run a full scan with an up-to-date, reputable security product, followed by a second-opinion scanner if appropriate.
• Check for unusual startup entries, scheduled tasks, services, recently created files, and unexpected outbound connections.
• From a known-clean device, change passwords that may have been entered on the system and enable multifactor authentication where available.
• If business, financial, or confidential data may have been accessed, preserve relevant logs and involve the organization’s IT or incident-response team.

A scan result alone may not prove that a system is clean because remote-access malware can establish persistence and steal credentials. If AtlasRAT or another RAT is confirmed, rebuilding the system from trusted installation media is often safer than attempting to remove every component manually.

For older Flash-dependent content, use an archived copy in an isolated virtual machine or a purpose-built preservation project. Do not download unofficial “Flash Player” installers from search results.